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DATA PROTECTION ACT 2018 
(PART 6, SECTION 149) 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 
ENFORCEMENT NOTICE 


DATED: 2 March 2021 


To: First Choice Selection Services Ltd 
Of: Unit 1, Cathedral Terrace, 19-27 Church Street, Belfast, BT1 1PG 


1. First Choice Selection Services Ltd (“First Choice”) (Companies House 
number NIO26337) is a “controller” as variously defined in sections 3(6) 
and 6 of the Data Protection Act 2018 (“the DPA”) and Articles 4(7) of 
the General Data Protection Regulation (“EU GDPR”) and Retained 
General Data Protection Regulation (as amended) (“UK GDPR”).? The 
controller is a recruitment agency. It processes personal data in the 


course of carrying out its functions. 


2. The Information Commissioner (“the Commissioner”) has decided to 
issue First Choice with an Enforcement Notice under section 149 DPA. 
The Notice is in relation to contraventions of Article 15 of the EU and UK 
GDPRs. This Notice is accordingly issued under section 149(2)(b) DPA. 


35 This Notice explains the Commissioner's decision. 


1 The subject access request in issue for the purposes of this Enforcement Notice was made on 7 May 
2020. From this date until 31 December 2020, the EU GDPR applied in the United Kingdom. Following 
the end of the transition period provided for under the EU-UK Withdrawal Agreement, the UK GDPR has 


applied in the United Kingdom. 
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Legislative Framework 


4. The DPA contains enforcement provisions in Part 6 which are exercisable 


by the Commissioner. 
5. Section 149 DPA materially provides: 


"(1) Where the Commissioner is satisfied that a person has failed, or is 
failing, as described in subsection (2), (3), (4) or (5), the Commissioner 
may give the person a written notice (an “enforcement notice”) which 
requires the person— 

(a) to take steps specified in the notice, or 

(b) to refrain from taking steps specified in the notice, or both (and 


see also sections 150 and 151). 


(2) The first type of failure is where a controller or processor has failed, 
or is failing, to comply with any of the following— 
(a) a provision of Chapter II of the UK GDPR or Chapter 2 of Part 
3 or Chapter 2 of Part 4 of this Act (principles of processing); 
(b) a provision of Articles 12 to 22 of the UK GDPR or Part 3 or 4 


of this Act conferring rights on a data subject; 


(6) An enforcement notice given in reliance on subsection (2), (3) or (5) 
may only impose requirements which the Commissioner considers 


appropriate for the purpose of remedying the failure.” 


6. Section 150 DPA materially provides: 


"(1) An enforcement notice must— 
(a) state what the person has failed or is failing to do, and 
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(b) give the Commissioner’s reasons for reaching that opinion. 


(2) In deciding whether to give an enforcement notice in reliance on 
section 149(2), the Commissioner must consider whether the failure has 


caused or is likely to cause any person damage or distress. 


(4) An enforcement notice may specify the time or times at which, or 
period or periods within which, a requirement imposed by the notice 


must be complied with (but see the restrictions in subsections (6) to 


Chapter 3 of both the EU GDPR and UK GDPR makes provision for the 
rights afforded to data subjects. These include the rights of subject 


access, rectification, erasure and restriction of processing. 


Specifically, Chapter 3, Article 15 of the UK GDPR materially provides, 


insofar as relevant: 


"(1) the data subject shall have the right to obtain from the controller 
confirmation as to whether or not personal data concerning him or her 
are being processed, and, where that is the case, access to the personal 
data and the following information: 

(a) the purposes of the processing; 

(b) the categories of personal data concerned; 

(c) the recipients or categories of recipient to whom the 

personal data have been or will be disclosed, in particular 


recipients in third countries or international organisations; 
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(d) where possible, the envisaged period for which the personal 
data will be stored, or, if not possible, the criteria used to 
determine that period; 

(e) the existence of the right to request from the controller 
rectification or erasure of personal data or restriction of 
processing of personal data concerning the data subject or 
to object to such processing; 

(f) the right to lodge a complaint with the Commissioner; 

(g) where the personal data are not collected from the data 
subject, any available information as to their source; 

(h) the existence of automated decision-making, including 
profiling, referred to in Article 22(1) and (4) and, at least in 
those cases, meaningful information about the logic 
involved, as well as the significance and the envisaged 


consequences of such processing for the data subject. 


(3) the controller shall provide a copy of the personal data undergoing 
processing. For any further copies requested by the data subject, the 
controller may charge a reasonable fee based on administrative costs. 
Where the data subject makes the request by electronic means, and 
unless otherwise requested by the data subject, the information shall be 


provided in a commonly used electronic form. ...” 


For the purpose of this Enforcement Notice, there is no material 
difference between Article 15 of the UK GDPR and Article 15 of the EU 
GDPR. 


Article 5 of both the EU and UK GDPRs are worded identically. Article 


5(1) sets out various principles that apply to the processing of personal 
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data, including, at Article 5(1)(a), that personal data shall be “(a) 
processed lawfully, fairly and in a transparent manner in relation to the 


data subject (‘lawfulness, fairness and transparency’)”. 


11. Article 5(2) sets out the “accountability” principle. This provision 
provides: “The controller shall be responsible for, and be able to 


demonstrate compliance with, paragraph 1”. 
Background to the case 


12. (“the Data Subject”) submitted a subject access 
request to First Choice on 7 May 2020 by email in the following terms 


(emphasis in original): 
“Subject Access Request 


Please supply the requested personal data which you hold about me, 
which I am entitled to receive under UK Data Protection Laws. This 


should include, but not be limited to, the following; 


1) All documents sent by the to 
First Choice (FC) staff 


2) Any document sent by FC to any third party and should include a list 
of third party agencies to whom FC have disclosed my personal data and 


a copy of the information FC have disclosed. 
3) Any document sent by a third party to First Choice 


4) Any telephone audio file and any audio file or telephone transcription 


between First Choice and a third party 
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5) All meeting notes whether I was present or not. 

6) My complete Personnel Dossier 

7) Where there has been any event in my history over this period from 
September 2017 to May 2020 which has required manual intervention 
by any person, I require disclosure of any indication or notes which have 


caused or resulted in that manual intervention. 


8) A Genuine copy of any notice of fair use of my data as required by the 
Data Protection Act 1998. 


9) Copies of all relevant First Choice company procedures and processes. 
10) Total number of shifts worked by me at F choice, 

b) Total amount paid to me for those shifts (before and after back pay). 
c) Please provide the total amount paid to me in holiday pay 

d) Please provide total hours of holiday pay paid to me. 


e) Please provide the calculations used to calculate that holiday pay 


including rates of pay per hour and total. 


f) Please refer to the exact excerpt relevant text from Ts and Cs , which 


was not attached to the email sent to me 29 April 2020, although 


B- it was. 


13. 


14. 
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I request this data to be sent to me via email not post , in original form 


and unredacted. 


If you need any more information, please let me know as soon as 


possible. 


I understand that the data protection laws requires you to respond to a 
request for personal data within one calendar month/28 days. As of 25 
May 2018, subject access requests can be made with no charge imposed, 
when GDPR became law in the UK as the Data Protection Act 2018. 


If you need advice on dealing with this request, the Information 
Commissioner’s Office can assist you. Its website is ico.org.uk, or it can 
be contacted on 0303 123 1113.” 


an Area Manager for First Choice, replied to the Data 


Subject’s email on the same day. His email stated: 


“I have no intention of releasing this information to you. I will at the 
required time release what the tribunal designate as the required 


material in relation to your claim.” 


The Data Subject replied to this email on the same day, reminding First 
Choice of its obligations under data protection law. First Choice replied 


to this email on the same day, stating: 


“You only have any right to relevant information to your claim, not a 
wish list of documents which you have no need to see even if some of 


them existed. 


15; 
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18. 
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As indicated I will provide all required information related to your claim 


when instructed to do so by the Tribunal.” 


The Data Subject subsequently complained to the Commissioner on 7 
May 2020. Following receipt of this complaint, the Commissioner wrote 
to First Choice on 11 June 2020, reminding it of its obligations under 
data protection legislation and requiring it to take appropriate steps to 


respond to the subject access request. 


No reply was received from First Choice. Following a telephone 
conversation with i on 24 July 2020, the Commissioner wrote to 
it again on this date, stating that she considered First Choice to be in 
breach of its data protection obligations and requiring it to review the 


subject access request and provide an appropriate response. 


The Commissioner wrote to First Choice again on 12 August 2020 
because it had neither provided an appropriate response to the subject 
access request, nor provided a timescale of when it would be in a position 
to do so. The Commissioner required First Choice, within 7 calendar 
days, to either provide an appropriate response or a timescale for 


responding. 


First Choice failed to comply with this requirement. The Commissioner 
therefore sent a further letter to First Choice on 27 August 2020, 
concluding that it had infringed data protection legislation by failing to 


deal appropriately with the subject access request. 


First Choice wrote to the Commissioner on 28 August 2020. First Choice 
stated that the Data Subject was involved in ongoing Employment 


Tribunal proceedings against First Choice and that: 


20. 
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“In discussions with the Judge around the issues of documents we were 
instructed to release no information at this stage and as part of the 
ongoing case we will be instructed to release appropriate documents to 


[the Data Subject] as required for the case. 


This is next due to be discussed on 1st October 2020 ...” 


Following the Commissioner’s letter of 27 August 2020, First Choice did 
not take appropriate steps to respond to the subject access request. On 
1 December 2020, the Commissioner therefore wrote again to the CEO 
of First Choice. This letter stated that: 


“In line with the accountability principle I would therefore like you to 
provide a full explanation as to why FC has been unwilling to correspond 
with the ICO and has yet to provide [the Data Subject] with any data 


she is entitled to receive in response to her SAR. 


Please note, if we consider there to be a failure in your organisation’s 


data handling practices, we may take further regulatory action. 


Could you please provide a response to me outlining FC’s position on this 


matter within 7 days (8 December). 


I would also strongly recommend that [the Data Subject’s] SAR is dealt 


with as a matter of urgency and if possible, in the next 14 days.” 


First Choice replied on 3 December 2020, again referring to the 
Employment Tribunal Proceedings. It told the Commissioner that the 
Tribunal had instructed the parties that “any exchange of documents 
should not take place until the claims have been fully identified and how 
they are to be addressed in regards to relevant information and 


documentation. ” 
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The Commissioner replied to this letter on 9 December 2020, requesting 


evidence of these purported instructions. 


Following a chasing email from the Commissioner on 17 December 2020, 


First Choice responded on the same day, stating that: 


“.. at the most recent hearing on this case the issue of an exchange of 
documents was discussed. It was pointed out to both parties that given 
the nature of the issues and the likely involvement of other parties given 
the nature of the claim, it would be inappropriate to provide those 


documents at this point.” 


On 18 December 2020, the Data Subject emailed the Commissioner 
attaching the Record of Proceedings of a 1 October 2020 hearing. The 
Data Subject said that this hearing was the most recent hearing in the 
Employment Tribunal. This Record undernnined First Choice’s claim that 
“the issue of an exchange of documents” had been discussed at this 


hearing. 


Following receipt of this email from the Data Subject, and First Choice’s 
failure to produce any evidence to support its position, the Commissioner 


wrote again to First Choice on 7 January 2021. This letter stated: 


“You have failed to provide the ICO with evidence that the tribunal has 
stated that a SAR should not be responded to, as a result we are 
concerned that FCR has not taken its data protection responsibilities 
seriously as it has failed to provide this information to [the Data 


Subject]without a legitimate reason to do so. 


26. 


27. 
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FCR should now provide a SAR response to [the Data Subject] containing 
all of the data that she is entitled to receive. We believe this SAR is now 
outstanding and we recommend that you provide this information to her 


within 7 days. Failure to do so may result in further regulatory action. 


You should respond to this email within 7 days to explain what action 
FCR will take in relation to this letter. If you are going to provide [the 
Data Subject] with the information you should do so within 7 days and 
write back to us to tell us this is what you have done. If you do not 
respond to [the Data Subject], or to this email within 7 days with 
evidence to support your reasons for not supplying the data, then I will 


recommend further regulatory action is considered against FCR.” 


First Choice replied on 7 January 2021, asking the Commissioner to 
“advise ... as the expert in this what is required within the law to be 
provided”. The Commissioner replied on 13 January 2021, explaining 
that she could not provide such advice. However, this letter set out a 
summary of the relevant data protection obligations and a link to a 
relevant section of the Commissioner’s website. The letter asked for a 
confirmation within 7 days of how First Choice intended to respond to 


the subject access request. 


The Commissioner received no response from First Choice. One of her 
employees subsequently telephoned First Choice on 26 January 2021, 
asking First Choice to contact her. To date, the Commissioner is yet to 


receive further communication from First Choice. 


On 14 January 2021, the Data Subject forwarded to the Commissioner 
an email she had received from the Employment Tribunal that day. In 
response to the suggestion that the Tribunal’s directions had prevented 


First Choice from complying with its data protection obligations, this 
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email stated that “the Tribunal has no jurisdiction to deal with matters 


relating to data protection requests”. 


The contravention 


29. In light of the above, the Commissioner is of the view that First Choice 
has contravened Article 15 of the EU GDPR, and Article 15 of the UK 
GDPR, in that it has failed to inform the Data Subject, without undue 
delay, whether their personal data is being processed by or on behalf of 
the controller and, where that is the case, has failed without undue delay 
to provide access, in an intelligible form, to such personal data, and to 


the information as set out at Article 15(1). 


30. First Choice has sought to avoid complying with its obligations on the 
basis that the Employment Tribunal instructed it not to provide any 
documentation to the Data Subject. However, First Choice has been 
unable to evidence this assertion. Furthermore, First Choice’s 17 
December 2020 email appears inconsistent with the Record of 
Proceedings document provided by the Data Subject on 18 December 
2020. Whilst the Employment Tribunal’s email of 14 January 2021 to the 
Data Subject makes clear that it gave no instructions in relation to the 
subject access request. The Commissioner therefore concludes from 


these circumstances that First Choice either: 


a. Has wilfully sought to mislead the Commissioner by claiming 
that the Employment Tribunal had given instructions not to 
release the information contained in the subject access request 


when the Tribunal had given no such instructions; and/or 


© 
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b. Is in breach of the accountability principle at Article 5(2) of the 


EU and UK GDPRs because it is unaware of the extent of its data 


protection obligations. 
Issue of the Notice 


31. The Commissioner has considered, as she is required to do under section 
150(2) DPA when considering whether to serve an Enforcement Notice, 
whether any contravention has caused or is likely to cause any person 
damage or distress. The Commissioner has decided, on the basis of 
correspondence with the Data Subject, that it is likely that damage or 


distress has been caused in this instance. 


32. Having regard to the significant level of the contravention, in particular 
the length of time since First Choice received (7 May 2020) the subject 
access request, the Commissioner considers that an Enforcement Notice 
would be a necessary and proportionate regulatory step to bring First 
Choice into compliance. 


33. In view of the above, the Commissioner is minded to exercise her powers 
under section 149(2)(b) DPA to require the controller to take the steps 


specified in Annex 1 of this Notice. 


Consequences of failing to comply with an Enforcement Notice, 


34. Ifa person fails to comply with an Enforcement Notice the Commissioner 
may serve a penalty notice on that person under section 155(1)(b) DPA 
requiring payment of an amount up to £17,500,000 or 4% of an 


undertaking’s total annual worldwide turnover whichever is the higher. 
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Right of Appeal, 


35. By virtue of section 162(1)(c) DPA, there is a right of appeal against this 
Notice to the First-tier Tribunal (Information Rights). Information about 


your right of appeal is set out in the attached Annex 2. 
Dated the 24 day of March 2021 


Andy Laing 

Head of Data Protection Complaints 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 


TERMS OF THE ENFORCEMENT NOTICE 


THIS NOTICE REQUIRES THE CONTROLLER TO TAKE THE FOLLOWING 
STEPS: 


1) By no later than 01 April 2021, to have informed the individual referred 
to at paragraph 12, who has made a subject access request, whether or 
not First Choice is processing personal data concerning this individual, 
and if so provide this individual with a copy of their data, subject only to 
the proper application of any exemption from, or restriction or 
adaptation of, the right of subject access provided for in or by virtue of 
the UK GDPR or DPA. 


2 


YS 


Furthermore, by 01 April 2021 at the latest, First Choice is to carry out 
such changes to its internal systems, procedures and policies as are 
necessary to ensure that future subject access requests received by First 
Choice, in respect of it, are identified and complied with in accordance 
with Article 15 of the UK GDPR, subject only to the proper application of 
any exemption from, or restriction or adaptation of, the right of subject 


access provided for in or by virtue of the UK GDPR or DPA. 


3) Continue to use its best endeavours to surpass the milestones referred 


to in paragraphs (1) and (2) above. 
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ANNEX 2 


RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 162(1)(c) of the Data Protection Act 2018 gives any person upon 
whom an enforcement notice has been served a right of appeal to the 
First-tier Tribunal (Information Rights) (“the Tribunal”) against the 


notice. 
2. If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of discretion 
by the Commissioner, that she ought to have exercised her 


discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3. If an appeal is brought, this Notice need not be complied with pending 
determination or withdrawal of that appeal. Information about the 


appeals process may be obtained from: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LE1 8DJ 13 
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Telephone: 0300 123 4504 


Email: grc@justice.gov.uk 


. Any Notice of Appeal should be served on the Tribunal within 28 calendar 


days of the date on which this Notice is sent. 


. The statutory provisions concerning appeals to the First-tier Tribunal 
(General Regulatory Chamber) are contained in sections 162 and 163 of 
the Data Protection Act 2018, and the Tribunal Procedure (First-tier 
Tribunal) (General Regulatory Chamber) Rules 2009 (Statutory 
Instrument 2009 No.1976 (L.20)). 


